<!DOCTYPE html>
<html lang="en-us">
  <head>

    <meta http-equiv="content-type" content="text/html; charset=utf-8">
    
<meta charset="UTF-8">
<title>Monitoring in a production environment | Elasticsearch Guide [7.7] | Elastic</title>
<link rel="home" href="index.html" title="Elasticsearch Guide [7.7]">
<link rel="up" href="monitor-elasticsearch-cluster.html" title="Monitor a cluster">
<link rel="prev" href="how-monitoring-works.html" title="How monitoring works">
<link rel="next" href="configuring-metricbeat.html" title="Collecting Elasticsearch monitoring data with Metricbeat">
<meta name="DC.type" content="Learn/Docs/Elasticsearch/Reference/7.7">
<meta name="DC.subject" content="Elasticsearch">
<meta name="DC.identifier" content="7.7">
<meta name="robots" content="noindex,nofollow">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <script src="https://cdn.optimizely.com/js/18132920325.js"></script>
    <link rel="apple-touch-icon" sizes="57x57" href="/apple-icon-57x57.png">
    <link rel="apple-touch-icon" sizes="60x60" href="/apple-icon-60x60.png">
    <link rel="apple-touch-icon" sizes="72x72" href="/apple-icon-72x72.png">
    <link rel="apple-touch-icon" sizes="76x76" href="/apple-icon-76x76.png">
    <link rel="apple-touch-icon" sizes="114x114" href="/apple-icon-114x114.png">
    <link rel="apple-touch-icon" sizes="120x120" href="/apple-icon-120x120.png">
    <link rel="apple-touch-icon" sizes="144x144" href="/apple-icon-144x144.png">
    <link rel="apple-touch-icon" sizes="152x152" href="/apple-icon-152x152.png">
    <link rel="apple-touch-icon" sizes="180x180" href="/apple-icon-180x180.png">
    <link rel="icon" type="image/png" href="/favicon-32x32.png" sizes="32x32">
    <link rel="icon" type="image/png" href="/android-chrome-192x192.png" sizes="192x192">
    <link rel="icon" type="image/png" href="/favicon-96x96.png" sizes="96x96">
    <link rel="icon" type="image/png" href="/favicon-16x16.png" sizes="16x16">
    <link rel="manifest" href="/manifest.json">
    <meta name="apple-mobile-web-app-title" content="Elastic">
    <meta name="application-name" content="Elastic">
    <meta name="msapplication-TileColor" content="#ffffff">
    <meta name="msapplication-TileImage" content="/mstile-144x144.png">
    <meta name="theme-color" content="#ffffff">
    <meta name="naver-site-verification" content="936882c1853b701b3cef3721758d80535413dbfd">
    <meta name="yandex-verification" content="d8a47e95d0972434">
    <meta name="localized" content="true">
    <meta name="st:robots" content="follow,index">
    <meta property="og:image" content="https://www.elastic.co/static/images/elastic-logo-200.png">
    <link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">
    <link rel="icon" href="/favicon.ico" type="image/x-icon">
    <link rel="apple-touch-icon-precomposed" sizes="64x64" href="/favicon_64x64_16bit.png">
    <link rel="apple-touch-icon-precomposed" sizes="32x32" href="/favicon_32x32.png">
    <link rel="apple-touch-icon-precomposed" sizes="16x16" href="/favicon_16x16.png">
    <!-- Give IE8 a fighting chance -->
    <!--[if lt IE 9]>
    <script src="https://oss.maxcdn.com/html5shiv/3.7.2/html5shiv.min.js"></script>
    <script src="https://oss.maxcdn.com/respond/1.4.2/respond.min.js"></script>
    <![endif]-->
    <link rel="stylesheet" type="text/css" href="/guide/static/styles.css">
  </head>

  <!--© 2015-2021 Elasticsearch B.V. Copying, publishing and/or distributing without written permission is strictly prohibited.-->

  <body>
    <!-- Google Tag Manager -->
    <script>dataLayer = [];</script><noscript><iframe src="//www.googletagmanager.com/ns.html?id=GTM-58RLH5" height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
    <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start': new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0], j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src= '//www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f); })(window,document,'script','dataLayer','GTM-58RLH5');</script>
    <!-- End Google Tag Manager -->

    <!-- Global site tag (gtag.js) - Google Analytics -->
    <script async src="https://www.googletagmanager.com/gtag/js?id=UA-12395217-16"></script>
    <script>
      window.dataLayer = window.dataLayer || [];
      function gtag(){dataLayer.push(arguments);}
      gtag('js', new Date());
      gtag('config', 'UA-12395217-16');
    </script>

    <!--BEGIN QUALTRICS WEBSITE FEEDBACK SNIPPET-->
    <script type="text/javascript">
      (function(){var g=function(e,h,f,g){
      this.get=function(a){for(var a=a+"=",c=document.cookie.split(";"),b=0,e=c.length;b<e;b++){for(var d=c[b];" "==d.charAt(0);)d=d.substring(1,d.length);if(0==d.indexOf(a))return d.substring(a.length,d.length)}return null};
      this.set=function(a,c){var b="",b=new Date;b.setTime(b.getTime()+6048E5);b="; expires="+b.toGMTString();document.cookie=a+"="+c+b+"; path=/; "};
      this.check=function(){var a=this.get(f);if(a)a=a.split(":");else if(100!=e)"v"==h&&(e=Math.random()>=e/100?0:100),a=[h,e,0],this.set(f,a.join(":"));else return!0;var c=a[1];if(100==c)return!0;switch(a[0]){case "v":return!1;case "r":return c=a[2]%Math.floor(100/c),a[2]++,this.set(f,a.join(":")),!c}return!0};
      this.go=function(){if(this.check()){var a=document.createElement("script");a.type="text/javascript";a.src=g;document.body&&document.body.appendChild(a)}};
      this.start=function(){var a=this;window.addEventListener?window.addEventListener("load",function(){a.go()},!1):window.attachEvent&&window.attachEvent("onload",function(){a.go()})}};
      try{(new g(100,"r","QSI_S_ZN_emkP0oSe9Qrn7kF","https://znemkp0ose9qrn7kf-elastic.siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_ZID=ZN_emkP0oSe9Qrn7kF")).start()}catch(i){}})();
    </script><div id="ZN_emkP0oSe9Qrn7kF"><!--DO NOT REMOVE-CONTENTS PLACED HERE--></div>
    <!--END WEBSITE FEEDBACK SNIPPET-->

    <div id="elastic-nav" style="display:none;"></div>
    <script src="https://www.elastic.co/elastic-nav.js"></script>

    <!-- Subnav -->
    <div>
      <div>
        <div class="tertiary-nav d-none d-md-block">
          <div class="container">
            <div class="p-t-b-15 d-flex justify-content-between nav-container">
              <div class="breadcrum-wrapper"><span><a href="/guide/" style="font-size: 14px; font-weight: 600; color: #000;">Docs</a></span></div>
            </div>
          </div>
        </div>
      </div>
    </div>

    <div class="main-container">
      <section id="content">
        <div class="content-wrapper">

          <section id="guide" lang="en">
            <div class="container">
              <div class="row">
                <div class="col-xs-12 col-sm-8 col-md-8 guide-section">
                  <!-- start body -->
                  <div class="page_header">
<strong>IMPORTANT</strong>: No additional bug fixes or documentation updates
will be released for this version. For the latest information, see the
<a href="../current/index.html">current release documentation</a>.
</div>
<div id="content">
<div class="breadcrumbs">
<span class="breadcrumb-link"><a href="index.html">Elasticsearch Guide [7.7]</a></span>
»
<span class="breadcrumb-link"><a href="monitor-elasticsearch-cluster.html">Monitor a cluster</a></span>
»
<span class="breadcrumb-node">Monitoring in a production environment</span>
</div>
<div class="navheader">
<span class="prev">
<a href="how-monitoring-works.html">« How monitoring works</a>
</span>
<span class="next">
<a href="configuring-metricbeat.html">Collecting Elasticsearch monitoring data with Metricbeat »</a>
</span>
</div>
<div class="chapter xpack">
<div class="titlepage"><div><div>
<h2 class="title">
<a id="monitoring-production"></a>Monitoring in a production environment<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/monitoring/production.asciidoc">edit</a><a class="xpack_tag" href="/subscriptions"></a>
</h2>
</div></div></div>
<p>In production, you should send monitoring data to a separate <em>monitoring cluster</em>
so that historical data is available even when the nodes you are monitoring are
not. For example, you can use Metricbeat to ship monitoring data about Kibana,
Elasticsearch, Logstash, and Beats to the monitoring cluster.
If you are sending your data to the ESMS, see <a class="xref" href="esms.html" title="Elastic Stack Monitoring Service">Elastic Stack Monitoring Service</a>.</p>
<div class="important admon">
<div class="icon"></div>
<div class="admon_content">
<p>Metricbeat is the recommended method for collecting and shipping monitoring
data to a monitoring cluster.</p>
<p>If you have previously configured legacy collection methods, you should migrate
to using Metricbeat collection. Use either Metricbeat collection or
legacy collection methods; do not use both.</p>
<p>Learn more about <a class="xref" href="configuring-metricbeat.html" title="Collecting Elasticsearch monitoring data with Metricbeat"><em>Collecting monitoring data with Metricbeat</em></a>.</p>
</div>
</div>
<p>If you have at least a Gold Subscription, using a dedicated monitoring cluster
also enables you to monitor multiple clusters from a central location.</p>
<p>To store monitoring data in a separate cluster:</p>
<div class="olist orderedlist">
<ol class="orderedlist">
<li class="listitem">
<p>Set up the Elasticsearch cluster you want to use as the monitoring cluster.
For example, you might set up a two host cluster with the nodes <code class="literal">es-mon-1</code> and
<code class="literal">es-mon-2</code>.</p>
<div class="important admon">
<div class="icon"></div>
<div class="admon_content">
<div class="ulist itemizedlist">
<ul class="itemizedlist">
<li class="listitem">
To monitor an Elasticsearch 7.x cluster, you must run Elasticsearch 7.x
on the monitoring cluster.
</li>
<li class="listitem">
There must be at least one <a class="xref" href="ingest.html" title="Ingest node">ingest node</a> in the monitoring
cluster; it does not need to be a dedicated ingest node.
</li>
</ul>
</div>
</div>
</div>
<div class="olist orderedlist">
<ol class="orderedlist">
<li class="listitem">
<p>(Optional) Verify that the collection of monitoring data is disabled on the
monitoring cluster. By default, the <code class="literal">xpack.monitoring.collection.enabled</code> setting
is <code class="literal">false</code>.</p>
<p>For example, you can use the following APIs to review and change this setting:</p>
<div class="pre_wrapper lang-console">
<pre class="programlisting prettyprint lang-console">GET _cluster/settings

PUT _cluster/settings
{
  "persistent": {
    "xpack.monitoring.collection.enabled": false
  }
}</pre>
</div>
<div class="console_widget" data-snippet="snippets/1138.console"></div>
</li>
<li class="listitem">
<p>If the Elasticsearch security features are enabled on the monitoring cluster, create
users that can send and retrieve monitoring data.</p>
<div class="note admon">
<div class="icon"></div>
<div class="admon_content">
<p>If you plan to use Kibana to view monitoring data, username and password
credentials must be valid on both the Kibana server and the monitoring cluster.</p>
</div>
</div>
<div class="ulist itemizedlist">
<ul class="itemizedlist">
<li class="listitem">
If you plan to use Metricbeat to collect data about Elasticsearch or Kibana,
create a user that has the <code class="literal">remote_monitoring_collector</code> built-in role and a
user that has the <code class="literal">remote_monitoring_agent</code>
<a class="xref" href="built-in-roles.html#built-in-roles-remote-monitoring-agent">built-in role</a>. Alternatively, use the
<code class="literal">remote_monitoring_user</code> <a class="xref" href="built-in-users.html" title="Built-in users">built-in user</a>.
</li>
<li class="listitem">
<p>If you plan to use HTTP exporters to route data through your production
cluster, create a user that has the <code class="literal">remote_monitoring_agent</code>
<a class="xref" href="built-in-roles.html#built-in-roles-remote-monitoring-agent">built-in role</a>.</p>
<p>For example, the
following request creates a <code class="literal">remote_monitor</code> user that has the
<code class="literal">remote_monitoring_agent</code> role:</p>
<div class="pre_wrapper lang-console">
<pre class="programlisting prettyprint lang-console">POST /_security/user/remote_monitor
{
  "password" : "changeme",
  "roles" : [ "remote_monitoring_agent"],
  "full_name" : "Internal Agent For Remote Monitoring"
}</pre>
</div>
<div class="console_widget" data-snippet="snippets/1139.console"></div>
<p>Alternatively, use the <code class="literal">remote_monitoring_user</code> <a class="xref" href="built-in-users.html" title="Built-in users">built-in user</a>.</p>
</li>
</ul>
</div>
</li>
</ol>
</div>
</li>
<li class="listitem">
<p>Configure your production cluster to collect data and send it to the
monitoring cluster:</p>
<div class="ulist itemizedlist">
<ul class="itemizedlist">
<li class="listitem">
<a class="xref" href="configuring-metricbeat.html" title="Collecting Elasticsearch monitoring data with Metricbeat">Metricbeat collection methods</a>
</li>
<li class="listitem">
<a class="xref" href="collecting-monitoring-data.html" title="Collecting monitoring data using legacy collectors">Legacy collection methods</a>
</li>
</ul>
</div>
</li>
<li class="listitem">
(Optional)
<a href="/guide/en/logstash/7.7/configuring-logstash.html" class="ulink" target="_top">Configure Logstash to collect data and send it to the monitoring cluster</a>.
</li>
<li class="listitem">
<p>(Optional) Configure the Beats to collect data and send it to the monitoring
cluster.</p>
<div class="ulist itemizedlist">
<ul class="itemizedlist">
<li class="listitem">
<a href="/guide/en/beats/auditbeat/7.7/monitoring.html" class="ulink" target="_top">Auditbeat</a>
</li>
<li class="listitem">
<a href="/guide/en/beats/filebeat/7.7/monitoring.html" class="ulink" target="_top">Filebeat</a>
</li>
<li class="listitem">
<a href="/guide/en/beats/heartbeat/7.7/monitoring.html" class="ulink" target="_top">Heartbeat</a>
</li>
<li class="listitem">
<a href="/guide/en/beats/metricbeat/7.7/monitoring.html" class="ulink" target="_top">Metricbeat</a>
</li>
<li class="listitem">
<a href="/guide/en/beats/packetbeat/7.7/monitoring.html" class="ulink" target="_top">Packetbeat</a>
</li>
<li class="listitem">
<a href="/guide/en/beats/winlogbeat/7.7/monitoring.html" class="ulink" target="_top">Winlogbeat</a>
</li>
</ul>
</div>
</li>
<li class="listitem">
<p>(Optional) Configure Kibana to collect data and send it to the monitoring cluster:</p>
<div class="ulist itemizedlist">
<ul class="itemizedlist">
<li class="listitem">
<a href="/guide/en/kibana/7.7/monitoring-metricbeat.html" class="ulink" target="_top">Metricbeat collection methods</a>
</li>
<li class="listitem">
<a href="/guide/en/kibana/7.7/monitoring-kibana.html" class="ulink" target="_top">Legacy collection methods</a>
</li>
</ul>
</div>
</li>
<li class="listitem">
<p>(Optional) Create a dedicated Kibana instance for monitoring, rather than using
a single Kibana instance to access both your production cluster and monitoring
cluster.</p>
<div class="olist orderedlist">
<ol class="orderedlist">
<li class="listitem">
(Optional) Disable the collection of monitoring data in this Kibana instance.
Set the <code class="literal">xpack.monitoring.kibana.collection.enabled</code> setting to <code class="literal">false</code> in the
<code class="literal">kibana.yml</code> file. For more information about this setting, see
<a href="/guide/en/kibana/7.7/monitoring-settings-kb.html" class="ulink" target="_top">Monitoring settings in Kibana</a>.
</li>
</ol>
</div>
</li>
<li class="listitem">
<a href="/guide/en/kibana/7.7/monitoring-data.html" class="ulink" target="_top">Configure Kibana to retrieve and display the monitoring data</a>.
</li>
</ol>
</div>
</div>
<div class="navfooter">
<span class="prev">
<a href="how-monitoring-works.html">« How monitoring works</a>
</span>
<span class="next">
<a href="configuring-metricbeat.html">Collecting Elasticsearch monitoring data with Metricbeat »</a>
</span>
</div>
</div>

                  <!-- end body -->
                </div>
                <div class="col-xs-12 col-sm-4 col-md-4" id="right_col">
                  <div id="rtpcontainer" style="display: block;">
                    <div class="mktg-promo">
                      <h3>Most Popular</h3>
                      <ul class="icons">
                        <li class="icon-elasticsearch-white"><a href="https://www.elastic.co/webinars/getting-started-elasticsearch?baymax=default&amp;elektra=docs&amp;storm=top-video">Get Started with Elasticsearch: Video</a></li>
                        <li class="icon-kibana-white"><a href="https://www.elastic.co/webinars/getting-started-kibana?baymax=default&amp;elektra=docs&amp;storm=top-video">Intro to Kibana: Video</a></li>
                        <li class="icon-logstash-white"><a href="https://www.elastic.co/webinars/introduction-elk-stack?baymax=default&amp;elektra=docs&amp;storm=top-video">ELK for Logs &amp; Metrics: Video</a></li>
                      </ul>
                    </div>
                  </div>
                </div>
              </div>
            </div>
          </section>

        </div>


<div id="elastic-footer"></div>
<script src="https://www.elastic.co/elastic-footer.js"></script>
<!-- Footer Section end-->

      </section>
    </div>

<script src="/guide/static/jquery.js"></script>
<script type="text/javascript" src="/guide/static/docs.js"></script>
<script type="text/javascript">
  window.initial_state = {}</script>
  </body>
</html>
